CVE-2015-3246: Red Hat Libuser Race Condition Privilege Escalation

// Sentinel/Defender for Endpoint - detect libuser SUID helper abuse and /etc/passwd tampering (CVE-2015-3246)
let SuspiciousHelpers = dynamic(["userhelper", "chfn", "chsh", "newusers"]);
DeviceProcessEvents
| where ProcessCommandLine has_any (SuspiciousHelpers) or FileName in~ ("userhelper", "chfn", "chsh")
| where ProcessCommandLine contains "\n" or ProcessCommandLine matches regex @"(?i)(GECOS|:0:0:|/bin/(ba)?sh|roothelper)"
| extend LowPrivInvoker = tostring(AccountName)
| project Timestamp, DeviceName, AccountName, InitiatingProcessAccountName, FileName, ProcessCommandLine, InitiatingProcessCommandLine, ProcessId, InitiatingProcessId
| join kind=leftouter (
    DeviceFileEvents
    | where FolderPath == "/etc/passwd" and ActionType in ("FileModified", "FileCreated")
    | project PwTime=Timestamp, DeviceName, PwActor=InitiatingProcessAccountName, PwProc=InitiatingProcessFileName
) on DeviceName
| where isempty(PwTime) or abs(datetime_diff('second', Timestamp, PwTime)) < 60

index=os (sourcetype=linux_audit OR sourcetype="linux:audit" OR sourcetype=auditd)
| eval proc=coalesce(exe, proctitle)
| search (proc="*userhelper" OR proc="*chfn" OR proc="*chsh" OR proc="*newusers") OR (name="/etc/passwd" AND (type=PATH OR key="passwd_watch"))
| transaction host maxspan=60s
| search proc="*userhelper" OR proc="*chfn" OR proc="*chsh"
| where match(proctitle, "(?i)roothelper|:0:0:|/bin/(ba)?sh") OR like(proctitle, "%\n%")
| table _time host auid uid proc proctitle name syscall key
| sort - _time

sequence by host.id with maxspan=60s
  [ process where event.type == "start" and
      process.name in ("userhelper", "chfn", "chsh", "newusers") and
      user.id != "0" and
      (process.command_line : "*\n*" or process.command_line regex~ "(?i).*(roothelper|:0:0:|/bin/(ba)?sh).*") ]
  [ file where event.type in ("change", "creation") and file.path == "/etc/passwd" ]

SELECT QIDNAME(qid) AS event, sourceip, username, "Process Name" AS process, "Command" AS command, "Filename" AS filename, DATEFORMAT(devicetime,'yyyy-MM-dd HH:mm:ss') AS time
FROM events
WHERE LOGSOURCETYPENAME(devicetype) ILIKE '%Linux%'
  AND (
    ("Process Name" ILIKE '%userhelper' OR "Process Name" ILIKE '%chfn' OR "Process Name" ILIKE '%chsh')
    AND ("Command" IMATCHES '.*(roothelper|:0:0:|/bin/(ba)?sh).*' OR "Command" ILIKE '%\n%')
  )
  OR ("Filename" ILIKE '/etc/passwd' AND "Command" ILIKE '%write%')
ORDER BY devicetime DESC
LAST 24 HOURS

_sourceCategory=*linux* (userhelper OR chfn OR chsh OR newusers OR "/etc/passwd")
| where (exe matches "*userhelper" or exe matches "*chfn" or exe matches "*chsh")
| where (proctitle matches /(?i)(roothelper|:0:0:|\/bin\/(ba)?sh)/ or proctitle matches "*\n*")
| where auid != "0"
| fields _messagetime, host, auid, uid, exe, proctitle, name, syscall
| sort by _messagetime desc

rule cve_2015_3246_libuser_priv_esc {
  meta:
    author = "argus"
    description = "Detects CVE-2015-3246 libuser race-condition privilege escalation via SUID helper abuse"
    severity = "HIGH"
  events:
    $e.metadata.event_type = "PROCESS_LAUNCH"
    (
      $e.target.process.file.full_path = /.*\/(userhelper|chfn|chsh|newusers)$/ nocase
    )
    $e.principal.user.userid != "root"
    (
      $e.target.process.command_line = /(?i)(roothelper|:0:0:|\/bin\/(ba)?sh)/ or
      $e.target.process.command_line = /\n/
    )
    $e.principal.hostname = $host
  match:
    $host over 60s
  condition:
    $e
}

#event_simpleName=ProcessRollup2 event_platform=Lin
| in(field="FileName", values=["userhelper", "chfn", "chsh", "newusers"])
| UID!=0
| CommandLine=/(?i)(roothelper|:0:0:|\/bin\/(ba)?sh)/ OR CommandLine=/\n/
| table([@timestamp, ComputerName, UserName, UID, FileName, CommandLine, ParentBaseFileName])
| sort(@timestamp, order=desc)